CommandPath › Army MOS Guides › 25D
Army MOS Career Guide

25D — Cyber Network Defender:
Civilian Career Guide

A 25D is already framed around cyber defense work: CND infrastructure, routers, firewalls, IDS and IPS tools, alert analysis, firewall and host logs, incident response, damage assessment, risk assessment, compliance audits, penetration testing, mitigation, recovery, lifecycle management, COOP, TS/SCI eligibility, and DoD 8570-aligned IAT and IAM functions.

Info security median: $124,910
TS with SCI eligibility required
CISSP exam: $749
Army Chapter 10C note
Army Chapter 10C identifies 25D as Cyber Network Defender. Duties include Computer Network Defense specialties of infrastructure support, analyst, incident responder, auditor and manager; IAT and IAM functions under AR 25-2 and DoD 8570.01-M; protecting, monitoring, analyzing, responding to and detecting unauthorized cyberspace activity; deploying and administering CND infrastructure; deliberate configuration changes in response to alerts; analyzing IDS alerts, firewall logs, network traffic logs and host logs; incident response containment and eradication; incident validation, correlation and trending; network damage assessments; response actions; threat and vulnerability assessments; deviations from acceptable configurations and policies; routers, firewalls, IDS, IPS and CND tools; penetration testing, compliance audits, risk assessments, mitigation, recovery, incident tracking, COOP, lifecycle management, technology integration, accreditation, training, TS/SCI eligibility, and current IAT Level II or IAM Level I certification.
Civilian translation starts here
Build a 25D civilian career plan

Turn your MOS duties, mission evidence, credentials, and leadership scope into a targeted civilian roadmap.

Build My 25D Blueprint →
Section 01

Top Civilian Role Matches for 25D

Cybersecurity Analyst / SOC Analyst Top civilian bridge
$67k – $189k

25D duties map directly to SOC and cybersecurity analyst roles because the MOS includes alert analysis, CND tools, firewall logs, IDS and IPS events, host logs, network traffic, incident validation, and reporting. Civilian employers want tools, environments, ticket volumes, incidents triaged, false positives reduced, and reports that improved response decisions. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context.

SOCAlertsLogsReports
Demand improves when experience is tied to credentials, tools, and measurable outcomes
Source: BLS Information Security Analysts · Median $124,910 (May 2024)
Incident Responder / DFIR Analyst
$75k – $180k

Incident response, containment, eradication, incident correlation, network damage assessment, recovery activities, and evidence review translate into DFIR roles. The resume should show incident types, response playbooks, artifacts reviewed, timelines built, stakeholders briefed, and recovery actions coordinated without disclosing sensitive network details. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context.

Incident responseContainmentRecoveryArtifacts
Demand improves when experience is tied to credentials, tools, and measurable outcomes
Source: BLS Information Security Analysts · Median $124,910 (May 2024)
Vulnerability / Risk Assessment Analyst
$75k – $170k

Threat and vulnerability assessments, authorized penetration testing, compliance audits, risk assessments, deviations from acceptable configurations, and mitigation recommendations fit vulnerability management roles. Employers need scanning tools if releasable, risk ratings, remediation tracking, policy exceptions, reports, and measurable exposure reduction. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context.

VulnerabilityRiskComplianceMitigation
Demand improves when experience is tied to credentials, tools, and measurable outcomes
Source: BLS Information Security Analysts · Median $124,910 (May 2024)
Security Engineer / CND Infrastructure Specialist
$85k – $190k

CND infrastructure deployment and administration across routers, firewalls, IDS, IPS, defense-in-depth tools, lifecycle management, and technology integration can support security engineering. The strongest candidates describe architecture, configuration baselines, change controls, tool tuning, uptime, incident visibility, and policy alignment. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context.

FirewallsIDS/IPSArchitectureChange control
Demand improves when experience is tied to credentials, tools, and measurable outcomes
Source: BLS Computer Systems Analysts · Median $103,790 (May 2024)
Cybersecurity Manager / IAM Lead
$105k – $220k

Senior 25D duties include CND operations supervision, TTP and policy development, COOP support, IAM Level II and III functions, training command and staff, lifecycle management, accreditation, and senior technical advice. Civilian managers need scope: people led, systems protected, incidents managed, audits passed, and policies improved. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context. Include the scale, systems, records, constraints, stakeholders, and measurable outcomes so civilian readers can understand the work without military context.

IAMPolicyCOOPLeadership
Demand improves when experience is tied to credentials, tools, and measurable outcomes
Source: BLS Management Occupations · Group median $122,090 (May 2024)
Section 02

Transferable Strengths: What Civilian Employers Actually See

Risk-Based Technical Judgment
Cyber and spectrum work has operational consequences. Civilian employers value candidates who connect technical alerts, interference, configurations, tools, policies, and reports to risk, mission impact, and action.
Structured Analysis and Reporting
Incident reports, network damage assessments, frequency databases, interference logs, technical reports, and legal records all become stronger when the resume names the audience and decision supported.
Compliance and Configuration Discipline
25D and 25E both involve acceptable configurations, policy, databases, approvals, deconfliction, and reviews. Civilian readers recognize that as governance, audit readiness, and operational control.
Senior Advisory Experience
Both specialties can advise commanders and staff. Translate that into stakeholder briefings, technical recommendations, policy input, risk options, and decisions influenced.
Tool and System Fluency
Routers, firewalls, IDS/IPS, CND tools, automated frequency tools, SAR workflows, databases, generators, radios, and signal equipment show technical credibility when tied to outcomes.
Section 03

Common Mistakes 25Ds Make in the Civilian Job Search

01
Sounding Too Tactical
Civilian readers need judgment, safety, planning, training, compliance, and results. Avoid making the resume feel like a mission recap or equipment catalog.
02
Ignoring Credential Boundaries
Security, cyber, communications, legal, vehicle, and compliance roles often have civilian licenses, certifications, agency screening, or employer-specific requirements. Military experience supports the case but does not waive the gate.
03
Leaving Out Scale
Translate the size of teams, assets, records, systems, reports, incidents, equipment, and training events. Scale turns impressive but vague service language into proof.
Section 04

Certifications and Bridges That Matter for 25D

CompTIA Security+
Cost Verify current voucher price before schedulingTime Self-study or course-based preparationFormat Vendor exam

CompTIA Security+ remains a common DoD and contractor baseline. Current voucher pricing changed in 2026, so verify the official CompTIA store before purchase.

Baseline cyber bridge · Useful for DoD-screened roles
ISC2 CISSP
Cost CISSP exam: $749 in the AmericasTime Experience requirements applyFormat ISC2 exam through Pearson VUE

ISC2 pricing lists CISSP at $749 in the Americas.

Senior security bridge · Strong for experienced IAM and management roles
CompTIA CySA+
Cost Verify current voucher price before schedulingTime Self-study or course-based preparationFormat Vendor exam

CySA+ fits 25Ds targeting SOC, detection, vulnerability management, and incident response roles because it emphasizes analysis and response rather than only baseline security vocabulary.

Analyst bridge · Useful for SOC and vulnerability roles
Section 05

Resume Translation: From 25D to Civilian Language

Translate the military mission into civilian functions, constraints, tools, decisions, and measurable outcomes.

Before: Vague military language
Served as Army 25D. Conducted missions, trained personnel, maintained equipment, followed procedures, and supported operations.
After: Civilian language that gets callbacks
Protected and monitored network environments using CND infrastructure, firewalls, routers, IDS, IPS, host logs, network traffic logs, alert triage, incident validation, correlation, damage assessment, containment, eradication, recovery coordination, vulnerability assessments, compliance audits, risk assessments, configuration reviews, mitigation recommendations, incident tracking, COOP support, and technical reporting. Advised leaders on cyber risk, trained staff on CND matters, supported lifecycle management and accreditation activities, and maintained TS/SCI eligibility while protecting sensitive network details.
25D resume formula
Start with the civilian function, not the unit name.
Name systems, tools, records, procedures, and risk controls used.
Separate hands-on execution from planning, training, supervision, and quality control.
Show the environment: field, classified, legal office, operations center, network enclave, or vehicle crew.
State credential status honestly: earned, eligible, pursuing, required, or employer-specific.
Always quantify: missions, systems, personnel, records, incidents, reports, equipment, defects, or outcomes improved.
Last updated June 2026 using Army Chapter 10C MOS 25D pages 144-145, BLS Occupational Outlook Handbook wage data, ISC2 exam pricing, CompTIA certification information, FCC COLEM fee examples, NALA testing fees, NFPA PACE fees, OSHA Outreach fee guidance, and FEMA Independent Study where relevant.
Section 06

25D Civilian Career FAQs

What civilian jobs fit Army 25D experience best?
Strong matches include cybersecurity analyst, SOC analyst, incident responder, DFIR analyst, vulnerability analyst, security engineer, cybersecurity auditor, IAM lead, and cybersecurity manager.
How is 25D different from 17C?
25D is more defensive enterprise network and information assurance focused: CND infrastructure, logs, alerts, incident response, audits, configurations, IAM and IAT functions. 17C can include broader cyberspace operations and cyber effects.
Which cert should a 25D pursue first?
It depends on the target lane. Security+ helps baseline screening, CySA+ helps SOC and analysis roles, CISSP helps senior security and management roles, and cloud/vendor certs help platform-specific engineering paths.
What should a 25D quantify?
Quantify systems protected, alerts triaged, incidents handled, vulnerabilities remediated, audits supported, tools administered, reports produced, users trained, configurations corrected, and recovery time improved.
Next step
Translate 25D experience into a focused target list

Use CommandPath to map your strongest roles, credential gaps, resume bullets, and interview proof before you start applying.

Build My 25D Blueprint →